feat(api): complete phase 2.4 control plane

apps/api/src/production-control-plane.ts

@@ -0,0 +1,46 @@
+import { isAbsolute } from 'node:path';
+import {
+  buildControlPlaneApp,
+  type ControlPlaneApp,
+  type SafeControlPlaneUpstream,
+} from './control-plane.js';
+import { openDatabase } from './infrastructure/database/database.js';
+import { migrateDatabase } from './infrastructure/database/migrations.js';
+import { MacOSKeychainSecretStore } from './infrastructure/secrets/keychain-secret-store.js';
+import type { SecretStore } from './infrastructure/secrets/secret-store.js';
+import { createProductionUpstream } from './infrastructure/transport/production-upstream.js';
+
+export interface ProductionControlPlaneOptions {
+  readonly databasePath: string;
+  readonly store?: SecretStore;
+  readonly upstream?: SafeControlPlaneUpstream;
+}
+
+export function buildProductionControlPlane(
+  options: ProductionControlPlaneOptions,
+): ControlPlaneApp {
+  if (
+    typeof options.databasePath !== 'string' ||
+    options.databasePath.length === 0 ||
+    !isAbsolute(options.databasePath)
+  ) {
+    throw new Error('An explicit absolute SQLite database path is required');
+  }
+  const db = openDatabase(options.databasePath);
+  try {
+    migrateDatabase(db);
+    const app = buildControlPlaneApp({
+      db,
+      store: options.store ?? new MacOSKeychainSecretStore(),
+      upstream: options.upstream ?? createProductionUpstream(),
+      app: { logger: {} },
+    });
+    app.addHook('onClose', async () => {
+      if (db.open) db.close();
+    });
+    return app;
+  } catch (error) {
+    if (db.open) db.close();
+    throw error;
+  }
+}